Cyberwatch Documentation

1. Overview

Cyberwatch is a software for detecting and monitoring IT vulnerabilities.

Its purpose is to facilitate the management of vulnerabilities published by authorities, from their publication to decision-making (detection, prioritization, remediation, risk acceptance, ticket creation…).

Cyberwatch produces relevant and operational dashboards that facilitate IT risk analysis and provide decision support.

This section of the application constitutes the technical documentation of Cyberwatch.

The documentation is divided into sections, each presenting the features and technical specifics related to these sections.

For new users or users running a POC of the application, we recommend consulting the introduction to using the software guide.

The prerequisites for the installation intervention are specified in this section.

2. Use the Assets management module

2.1 Assets discoveries
- 2.1.1 Local infrastructure
- 2.1.2 Cloud infrastructure
- 2.1.3 Docker images
- 2.1.4 Network ranges
- 2.1.5 Domain names
- 2.1.6 Others
2.2 Presentation of different Cyberwatch scan modes
2.3 List of supported operating systems
2.4 Add an asset
- 2.4.1 Cyberwatch agent
  - 2.4.1.1 Add an asset in Cyberwatch in agent-based mode
  - 2.4.1.2 Prerequisites for assets monitored in agent-based mode
  - 2.4.1.3 Technical details on Windows agent
  - 2.4.1.4 Technical details on Linux agent
  - 2.4.1.5 Technical details on macOS agent
  - 2.4.1.6 Include Cyberwatch agent in a template
  - 2.4.1.7 Use the Cyberwatch agent command line
- 2.4.2 Agentless connections
  - 2.4.2.1 Add an asset in Cyberwatch in agentless mode
  - 2.4.2.2 Assets prerequisites for agentless connections
  - 2.4.2.3 Troubleshoot errors when adding an agentless connection
  - 2.4.2.4 Technical information on agentless connections for Windows systems
  - 2.4.2.5 Technical information on agentless connections for Linux systems
  - 2.4.2.6 Use WALLIX for agentless connections
  - 2.4.2.7 Use Conjur for agentless connections
  - 2.4.2.8 Use CyberArk CCP for agentless connections
  - 2.4.2.9 Use HashiCorp Vault for agentless connections
  - 2.4.2.10 Import agentless connections using an XLSX file
  - 2.4.2.11 Agentless connection information for industrial device
  - 2.4.2.12 Using AWS SSM to create agentless connections
- 2.4.3 Add air gap assets through a form
- 2.4.4 Add a Docker image
- 2.4.5 Add a network target or a website
- 2.4.6 Add a cloud project
- 2.4.7 Add a Kubernetes project
2.5 Assets status
2.6 Delete an asset
2.7 Customization
- 2.7.1 Syntax for assets comments
- 2.7.2 Customizing the inventory

3. Vulnerability management

3.1 Vulnerability scans
3.2 Ignore a vulnerability
3.3 Deploy a security fix
3.4 Reboot an asset
3.5 Manually apply a corrective action
3.6 Windows cab file usage
3.7 List of software monitored by Cyberwatch scans
3.8 List of optional Cyberwatch scans

4. Compliance management

4.1 Rules evaluation
4.2 Add repositories to assets
4.3 Default repositories
4.4 Apply a CERTFR_AD analysis to an Active Directory asset
4.5 Use the Compliance Custom module
4.6 Add benchmarks

5. Encyclopedias

5.1 Vulnerability encyclopedia
- 5.1.1 Vulnerabilities score
- 5.1.2 Use the vulnerabilities RSS feed
5.2 Description of Cyberwatch compliance repositories
5.3 Use security issues
5.4 Perform a search
- 5.4.1 Use saved and recent queries

6. Reports

7. Settings

7.1 Scanning policies
7.2 Use custom analyses
- 7.2.1 Declarative data syntax
7.3 Use the prioritization policy to prioritize vulnerabilities
7.4 Automatically exclude vulnerabilities
7.5 Deployment and reboot policies
7.6 Manage custom repositories
7.7 Rules
7.8 Groups

8. Alerts

8.1 Alerts use
8.2 Alerts user guide

9. Users

9.1 Manage Cyberwatch users
9.2 Manage rights of Cyberwatch users
9.3 Permissions
9.4 FAQ
9.5 Password-less accounts and use cases

10. Administration

10.1 Configure an LDAP directory
10.2 Configure the SAML Service Provider
- 10.2.1 SAML configuration example using ADFS
10.3 Authentication through OpenID Connect
10.4 Integrations
- 10.4.1 Configuring a Microsoft Teams integration
- 10.4.2 Setting up integration with ServiceNow
- 10.4.3 Configuring a GLPI integration
10.5 Configure Cyberwatch to use a remote Syslog server
10.6 Using Gravatar

11. Cyberwatch API Documentation

11.1 Cyberwatch API use
11.2 API query using curl
11.3 API query in PowerShell
11.4 Air gap scans with the API in PowerShell
11.5 Compliance Air gap with the API in PowerShell
11.6 Export an Asset’s SBOM
11.7 Cyberwatch MCP Server

12. Administration of the Cyberwatch software

12.1 Description of cbw-on-premise services
12.2 Reboot/Update Cyberwatch
12.3 Update the base of the orchestrator
- 12.3.1 Update the base of the orchestrator Swarm
- 12.3.2 Update orchestrateur base
12.4 Advanced configuration of Cyberwatch web front end server
12.5 Advanced configuration and administration of Cyberwatch databases
- 12.5.1 Fix a corrupted database
- 12.5.2 Procedure to backup and restore Cyberwatch
- 12.5.3 Use an external database
- 12.5.4 Use an external redis server
12.6 Docker configuration
- 12.6.1 Change the IP range used by Docker
- 12.6.2 Containers isolation by namespace
- 12.6.3 Automatically clean containers logs
12.7 Offline administration guides
12.8 Kubernetes
- 12.8.1 Update Cyberwatch application on Kubernetes
12.9 Advanced administration of Cyberwatch
12.10 Troubleshooting
- 12.10.1 Troubleshooting procedure
- 12.10.2 Consult Cyberwatch logs
- 12.10.3 Get a shell on Cyberwatch software
- 12.10.4 Performance issues and Sidekiq UI interface

13. Cyberwatch deployment

Cyberwatch deployment guides

14. Changelog

15. Technical support

For any technical question, please contact the Cyberwatch support:

by e-mail at support@cyberwatch.com
by phone at +33 1 84 80 88 84

A newsletter alerting about publication of new Cyberwatch releases can be automatically sent to users.

The newsletter includes the changelog of updates and tips on how to use new features.

To subscribe to this newsletter, please fill this form with your e-mail address.